CVE-2015-3167

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
PostgreSQL Global Development Group	PostgreSQL	before 9.0.20; 9.1.x before 9.1.16; 9.2.x before 9.2.11; 9.3.x before 9.3.7; and 9.4.x before 9.4.2

References

http://ubuntu.com/usn/usn-2621-1Third Party Advisory
http://www.debian.org/security/2015/dsa-3269Third Party Advisory
http://www.debian.org/security/2015/dsa-3270Third Party Advisory
http://www.postgresql.org/about/news/1587/Vendor Advisory
http://www.postgresql.org/docs/9.0/static/release-9-0-20.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.1/static/release-9-1-16.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.2/static/release-9-2-11.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.3/static/release-9-3-7.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.4/static/release-9-4-2.htmlRelease Notes, Vendor Advisory
http://ubuntu.com/usn/usn-2621-1Third Party Advisory
http://www.debian.org/security/2015/dsa-3269Third Party Advisory
http://www.debian.org/security/2015/dsa-3270Third Party Advisory
http://www.postgresql.org/about/news/1587/Vendor Advisory
http://www.postgresql.org/docs/9.0/static/release-9-0-20.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.1/static/release-9-1-16.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.2/static/release-9-2-11.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.3/static/release-9-3-7.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.4/static/release-9-4-2.htmlRelease Notes, Vendor Advisory

Timeline

Published: Nov 20, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-31696.1Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.CVE-2015-31705.5selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by cre CVE-2015-31715.5sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive CVE-2015-31725.4EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.CVE-2015-31737.2custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-31743.5mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bi CVE-2015-31755.8Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote CVE-2015-31764.3The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8 CVE-2015-31773.5Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor r CVE-2015-31783.5Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2 CVE-2015-31793.5login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users CVE-2015-31804.0lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated u